Here is a new version of the Basic Process Manipulation Tool Kit (bpmtk).
Some noteworthy changes:
- bpmtk.dll has been added
- for ASCII: and UNICODE:, now you can specify a string with spaces by enclosing it in double quotes (ASCII:”My Name”)
- write and search-and-write use VirtualProtectEx to change the virtual page protection when a write fails
So now you can also load the bpmtk as a DLL in a process and it will execute its configuration. The configuration is embedded in the DLL as an ASCII string. To change the configuration, you’ve 2 options:
- edit the source code and recompile the DLL
- binary edit bpmtk.dll and insert your config between the strings #BPMTK_CONFIG_BEGIN\r\n and #BPMTK_CONFIG_END\r\n. Terminate all lines of your config with CRLF
Didier Stevens 
Leave a Reply (comments are moderated)